The emails passed domain authentication checks because they appeared to have been sent through Robinhood's actual email infrastructure.